3.1 Site Core-Lab Interface Lexicon of Terms 



Term Definition 



Anonymizstion 


The process of de-identification and further removal or amiguation of information to 
reduce the probability of re-identification of the image despite access to other 
information sources 


Burned-in Information 


Information that is part of the actual pixel data as opposed to present in the image 
header. 


De-identification 


The process of removing real patient identifiers 


Dp-npcQntinl i7atinn 

L/C |JCI oUI Id 1 l£.a LI \Jl 1 


Thp nroppQQ nf pnmnlptplv rpmovinn Pnu ihippt-rplstpH infnrmp.tinn frnm an 

1 1 IC l_f 1 IAiCSo U 1 Ol-Jl 1 1 LJIC LCI y 1 CI 1 ILJ V 1 1 IU d 1 1 y oU UJC. LI CI CI LCLJ IIIILJIIIICILILJII IIUIII CI I 1 

image, including clinical trial identifiers. 


Imanp Hparipr 

IIIIQUW 1 IVUUvl 


That part of the file or dataset containing the image other than the pixel data itself 


Individually Identifiable 
Information 


Data that alone or in combination may be used to identify an individual. 


Personal information 


Data related to person identification - see EU guidances (e.g., Age) 


Pseudonymization 


The process of de-identification and replacement of identifiers with a pseudonym 
that is unique to the individual and known within the context of a trial but not linked 
to the individual in the external world. 


Sensitive Personal Information: 


Data related to personal preferences and disposition. - see EU guidances (e.g., 
Ethnicity). 


Unique Identifiers (UIDs): 


Globally unique identifier used to identifiers images, sets of images, or components 
within an image. 
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3.2 Site Core-Lab Interface - High Priority Areas 



High Priority Areas: 

De-identification of images and related information either by sites or by CRO on receipt from sites as an area of 
significant concern due to variation in privacy expectations, quality of work, conflicting or misunderstood regulation, lack of 
effective standards and lack of an audit trail, which would be amenable to standardization of policies, procedures, 
informed consent and tools, and for which there is no competitive advantage perceived. 

Transfer of images from sites to sponsor and/or CROs, though an area of significant logistic cost not likely one that can 
be solved by standardization of tools and procedures, nor standardized in a pre-competitive manner, and which may be 
resolved by the evolving global trend towards cross-enterprise electronic records and off-site archiving anyway; ideally 
PACS vendors would implement features to facilitate clinical trials but seem to be poorly motivated by small market; table 
for future consideration; worth describing the ideal state (specify generic or minimal requirements); other transfer related 
issues of interest include reducing the burden of documentation accompanying image transfer, especially that which 
duplicates the image headers. 

Compression specifically lossy image compression, which though theoretically undesirable and avoidable may have little 
impact on outcome for many types of trials, and is in practice used by many sites either during acquisition, or before 
archival and/or transfer and results in protocol violations; the scientific literature abounds in studies with respect to 
qualitative and quantitative impact for different modalities and applications and should be reviewed with respect to the 
possibility of defining a consensus position, or identifying areas for future research. 

Digitization whilst undesirable if direct digital acquisition is available, is unavoidable in some trials due to the nature of the 
modality or the timing or geographic extent of the trial; accordingly quality and performance standards are needed. 

Retention of images and associated information after a trial is complete and/or submitted is an area of uncertainty with 
respect to potentially inconsistent local, state and national regulations in global multi-center registrational trials with 
respect to confusion between clinical practice retention requirements (a site burden) as distinct from requirements on the 
sponsor and CROs for clinical trials; summarizing these requirements and/or clarifying or standardizing where gaps exist 
would be beneficial (may simply be a contractual matter - sponsors requirements exceed those of FDA, for example) - 
goal to establish good practice. 

Reuse of images and associated information, either in-house (in-sponsor or in-CRO or with software contractors) or after 
publicly released (as is being encouraged by the government) has specific requirements on additional de-identification, 
and additional IRB and/or subject consent may be expected (even if not required). 

Initiation and Monitoring of sites - is there a need for standard format of documentation, policies and procedures, 
especially for sites engaged in multiple clinical trials 

Validation of software used at sites and CROs for these purposes. 



09/10/2007 

DIA, PHRMA, MICAA, CORAR, AMIA 



25 



Confidential and Proprietary 



3.3 Site Core-Lab Interface - Proposed Standards 



1.0 Objective 

To identify high priority areas of concern related to interfacing with sites with respect to image acquisition and transfer that can 
be addressed through pre-competitive consensus and standardization. 

2.0 In Scope 

■ Registrational clinical trials involving the use of medical imaging (including radiology, nuclear medicine, and clinical 
photography) 

■ Human imaging only (not animals) 

■ In vivo imaging only 

■ Image-like bulk data, such as MR Spectroscopy 

■ Mature technologies suitable for regulatory approval 

■ Phantom images which are site and scanner specific for validating baseline imaging performance. These phantoms 
must be matched and intercalibrated in order to assure consistency among the multiple imaging sites. 

3.0 Out of Scope 

■ Specific needs of early drug development that differ from registrational clinical trials 

■ In vitro (e.g. pathology imaging, whole slide, TMAs) 

■ Experimental acquisition technologies (e.g. optical tomography) 

■ Acquisition protocols executed on the modality (being addressed by UPICT) 

■ Comprehensive sets of phantom images for daily quality control, and site qualification (being addressed by UPICT, 
NIST, ACR, SNM, ISMRM) - in table of contents only - (except for phantom and quality data transfer from sites, which 
is in scope) 

■ For the time being, image submission content and mechanics are not in scope but need to be tabled (in table of 
contents only). 

4.0 Methodology 

Consensus group of representatives from: 

■ Pharmaceutical and biotechnology companies 

■ Imaging contract research organizations 

■ Academic and community imaging sites 

■ Government (including regulators and research and standards institutes) will: 

■ Identify areas of concern 

■ Prioritize based on risk, return on investment and likelihood of consensus 

■ Propose standards to address areas of concern 

■ Seek broad consensus through public comments and meeting 

■ Adopt and promulgate standards (which organization, if not FDA (guidance or regulation) - DIA ? DICOM ? CDISC ? 
IHE ?) 

■ Promote adoption and acceptance of standards 
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5.0 High Priority Areas: 



5.1. De-Identification 

De-identification of images and related information received during the course of clinical trials is a major concern. 
Whether this process is performed by sites themselves, or by the CRO on receipt of data from sites, is of significant 
concern due to variation in privacy expectations, quality of work, conflicting or misunderstood regulation, lack of 
effective standards and lack of an audit trail. These concerns which be amenable to standardization of policies, 
procedures, informed consent and tools. 

5.1.1 Informed Consent 

In the conduct of obtaining informed consent, authorization to make use of personal information is usually obtained, as 
is permission to share this information with other parties involved in the trial. 

There is a risk of delay or reduced enrollment if an IRB or ethics committee has privacy concerns about a particular 
protocol or informed consent. Regardless of actual regulations, site privacy advocates and/or risk managers may have 
additional requirements. 

There is a benefit to use of standardized informed consent language and templates. The goal is to meet all national 
minimal requirements, since many multi-center trials are international, to allow for faster IRB passage, perhaps using 
text pre-approved by "central" IRB. 

Such text should make it clear to the subject that there is always some risk of leakage of identity (no system is 
perfect). Some sites or nations may insist on "complete" or "absolute" de-identification and/or anonymization, but such 
terms are meaningless without further qualification. 

See also additional requirements in the section on Re-use. 
5.1.2. Process 

Sites or CROs or both may perform de-identification and pseudonymization (true anonymization is generally not a 
concern for trials except during re-use). 

Sites often lack consistent tools, maintain no audit trails, have no quality control procedures to ensure that de- 
identification is complete or pseudonymization with the correct clinical trial identifiers is performed. CROs are expect to 
have such tools, audit trails and procedures. 

Increasingly sites are concerned about releasing data containing individually identifiable information, even if the 
subject has specifically authorized such release. Sponsors are increasingly concerned about possession of individually 
identifiable information and the risk and burden of protecting it and monitoring its use. Accordingly standards need to 
be set and tools need to be provided for sites to use to perform this task. 



09/10/2007 

DIA, PHRMA, MICAA, CORAR, AMIA 



27 



Confidential and Proprietary 



Whether or not sites perform de-identification and pseudonymization, CROs are still required to be able to perform 
these tasks, as well as provide oversight of the site's process. This oversight may be remotely performed (by checking 
the incoming data for quality and compliance with de-identification) and by monitoring (on-site evaluation of the 
correctness and completion). 

It is undesirable (and in some cases forbidden) to collect the same information multiple times, for example to gather 
ethnicity on both a CRF and in the image headers. The extent to which this is a realistic or hypothetical concern or 
misinterpretation is unknown, but in general, the least amount of information necessary should be gathered to 
accompany the images. 



5.1 .3. What to remove 

Standards need to be established for what needs to be removed and replaced during de-identification without 
compromising the utility of the data for the purpose of the trial. There exist standards and profiles, such as the Basic 
Confidentiality Profile in DICOM PS 3.15, but this needs to be specifically tailored to the needs of clinical trials. Other 
standards such as the I HE Teaching File and Clinical Trial Export Profile address general concerns (such as the 
removal of identification burned in to pixel data and the replacement of UIDs) without specifically setting standards for 
any particular application. The HIPAA Privacy Rule lists 18 elements that if removed are deemed to be sufficient, but 
removal of all of them may render the data unusable for the trial. The Privacy Rule allows for an alternative approach. 
The Privacy Rule also does not mandate that the data be rendered de-identified for research if the appropriate 
authorization has been obtained. 

There may be a conflict between privacy and trial requirements. Some trials require the presence of personal 
information that may or may not be considered sensitive and that may or may not compromise anonymity, for example: 

a) Sex and body weight are required for SUV determination in PET studies; 

b) Sex and age may be required for stratification; 

c) Visit (exam) dates are generally required for longitudinal comparison. 

It is proposed to standardize (via the DICOM Clinical Trials Working Grouping 18) specific profiles for de-identification 
and pseudonymization for specific types of trials. These profiles will detail for each category of trial the specific DICOM 
attributes that shall be removed from the header and the specific types of burned-in identification that shall be 
removed. The general requirements below will need to be satisfied. Note that these requirements address both 
information that is explicitly identifiable, information that when linked to external data sources may compromise 
anonymity, and information that when linked to site data sources may compromise anonymity. 

a) Explicit identifiers (name, medical record number, national identifier number, initials) shall always be 
completely removed; 

b) Personal information that compromises anonymization, such as date of birth, shall be removed where 
alternative stratification information such as age at time of exam can be substituted; 

c) Personal information useful for interpretation or stratification or obvious from the images, such as sex, 
may be retained; 

d) Rounding or grouping of personal information, such as age by decade, may be used where appropriate; 
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e) Site and personnel information, shall be removed (e.g., the name and address of the institution or 
physician or operator), and if appropriate, site codes substituted; 

f) Equipment identifying information of a categorical type (e.g., manufacturer and model and version) may 
be retained, but specific identifiers (such as device serial number) shall be removed except for those 
trials in which critical quality information may need to be linked to specific devices; we agree with this 
comment]] 

g) Date information related to visits and imaging studies shall be retained if it is necessary for longitudinal 
comparison in the conduct of the trial - though mechanisms exist to concert dates to canonical dates and 
offsets, the likelihood of error by the sites is too high to allow the risk; further, there is a need to be able 
to match information about the same visit from disparate sources (e.g., images and clinical or lab data); 
one way has based algorithms exist to combine identity and date information to maintain longitudinal 
integrity in a anonymous manner but may be impractical to deploy routinely in a multi-center 
configuration; 

h) Unique identifiers shall be removed and replaced with new unique identifiers, whilst retaining referential 
integrity amongst a set of images; the process may or may not need to be deterministic; and (perhaps 
based on hashing the originals) 

i) All attributes whose meaning and content are uncertain shall be removed (this includes unrecognized, 
proprietary or private attributes in DICOM images) 

The general requirements with respect to the type of information shall be equally applicable to head attributes and 
burned-in information. Furthermore, the risk of information stored in unexpected or inappropriate attributes shall be 
considered. For example, the machine operator may have included the Patient Name not just in the Patient Name 
attribute, but also in the Study Description; accordingly, all string fields present a risk of identity leakage. Accordingly, 
DICOM WG 18 will be asked to consider the feasibility of removal of all string values except where the content can be 
proven to be safe, e.g., by searching for and substituting specific coded values (e.g., "Chest CT" might be a legal 
value) and by validating the content of string numeric fields to contain only the correct characters (e.g., Study Date 
should be of the form "yyyymmdd" and should not contain letters). 

A distinction is made between the information accompanying the image and the image of the subject itself, just as a 
distinction is commonly made between labels and specimens of blood or tissue. As there is a risk of re-identification 
from DNA comparison, there is a risk of re-identification of the images themselves (quite apart from burned in 
information), whether from full face photographic images or facial features potentially recognizable from 3D 
reconstruction of high resolution head CT or MR. Trials are underway to quantify the risk of recognition attached to 
such 3D reconstructions. Though processes have been proposed to de-face images without undermining their utility 
for some types of clinical trials, they are beyond the scope of the current discussion and will be tabled for further 
review when there is more information about the need and the utility. 
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5.1 .4 Quality Control and Audit Trail 

Ideally, an organization with defined and monitored processes and systems would have access to the original 
information as acquired from the acquisition device and would perform de-identification and pseudonymization. To the 
extent that these responsibilities must be divided between the sites and the CROs, the following requirements shall be 
satisfied: 

a) any changes to data that are a consequence of passage through clinical systems at the site (such as 
transfer from modalities to PACS archives and workstations) shall be controlled, documented and 
performed using validated hardware and software only (such as approved medical devices) and shall not 
result in degradation (e.g., lossy compression after acquisition); note that no audit trail is expected or 
practical 

b) any changes to data that are a consequence of clinical trial specific action, such as de-identification and 
pseudonymization, shall be performed using validated software, and shall result in an audit trail of the 
changes that shall be maintained at the site and subject to periodic monitoring; the audit trail is not 
required to be transferred to the CRO if the site or CRO or sponsor has privacy concerns; this process 
and the audit trail shall be subject to quality control and monitoring procedures to affirm the correctness 
of the mapping from real subject to trial specific identifiers and the completeness of de-identification (the 
audit trail constitutes a mapping from which original identifiers, including individually identifiable and 
unique identifiers may be recovered, and as such needs to be protected and archived) 

c) the receiving CRO or sponsor shall perform further de-identification and pseudonymization as necessary, 
using validated software, and shall result in an audit trail of the changes made; leakage of identifying or 
sensitive information from the site shall be detected and the site queried and retrained as appropriate 

d) the original images shall be archived at the site as "source data" in compliance with GCP 

e) the images received by the CRO or sponsor shall be archived at the CRO or sponsor as their "source 
data", or shall be fully recoverable using the audit trail information, even if the site has failed to (or was 
not required to) perform de-identification and pseudonymization 

f) The overriding principle is to preserve the "source data" information at the appropriate location, the latter 
being determined by the mutually agreed upon privacy requirements. 

5.1.5. IRC 

The IRC should specifically document the extent of and responsibilities for de-identification and pseudonymization, 
quality control and the audit trail. 

In particular, the IRC should address the risks to "re-identification" by those parties who will have access to the data. 
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5.2. Transfer 



5.2.1 The transfer of images from sites to sponsors and/or CROs, between CRO and Sponsor, and to the 
Regulatory Agencies are out of scope for this standardization effort for the time being. 

Though an area of significant logistic cost, it is not likely one that can be solved by standardization of tools 
and procedures, nor standardized in a pre-competitive manner 

It is likely to be resolved by the evolving global trend towards cross-enterprise electronic records and off-site 
archiving anyway; ideally PACS vendors would implement features to facilitate clinical trials but seem to be 
poorly motivated by small market; such vendors have expressed reluctance to concern themselves with 
specific needs of clinical trials. 

5.2.2 A description of the "ideal state" in which acquisition and PACS at sites might be linked to a global network of 
CROs and Sponsors is worthy of future consideration, particularly to the extent that requirements or 
information technology standards or software could be identified. Evaluation of standards such as the IHE 
teaching File and Clinical Trial Export Profile has been mentioned; the use of freely available open source 
tools such as RSNA MIRC FieldCenter could be considered, particularly with respect to what de-identification 
configuration is necessary to satisfy the requirements of commercial clinical trials and IRBs and ethics 
committees. 

5.2.3 Other transfer related issues of interest for future consideration include reducing the burden of documentation 
accompanying image transfer, especially that which duplicates the image headers. 

Evaluation of outstanding issues that make IRBs and ethics committees and hospital IT departments reluctant 
to provide access for such networks remains an open task. 
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5.3. Compression 



5.3.1 Truly lossless compression, in which the original binary data is fully recoverable, is allowed under all 
circumstances, since the image is not in any way degraded. This is analogous to creating a compressed zip 
file of a document and decompressing it to recover the identical original. 

5.3.2 The use of lossy (irreversible) compression raises concern that the loss (degradation) in the image, even if 
"visually lossless" (i.e., not obviously apparent to a human observer) may result in impaired performance. 

5.3.3 The impact of lossy compression depends on the choice of compression algorithm (scheme), the parameters 
(compression ratio), the type of image (modality), and the interpretation or analysis task. Hence 
generalizations about the appropriateness of compression are dangerous. What might be appropriate for 
qualitative assessment may not be for quantitative assessment. Similarly contrast crude size measures 
versus volumetric measurements, for signal intensity measurement, for a human versus machine observer, 
for different sizes of lesions, or different tasks where variance due to compression may be overwhelmed by 
other sources of noise and variance. 

5.3.4 There are no standards for compression performance. The ACR Digital Image Management guideline, for 
example, leaves it to the discretion of the interpreter. A review of the contemporary literature reveals no clear 
consensus. Many trials are subjective quality assessments rather than true observer performance studies, 
and are arguably meaningless. The size of a study (statistical power to distinguish real lack of difference from 
insufficient cases/readers) is crucial and many studies in the literature fail to address this or are likely 
underpowered, The relevance of the task in compression study to the question in the clinical trial must be 
considered. The mix of images in study (which vary in compressibility depending on noise, size (including 
slice thickness), dynamic range etc.) and the mix of pathological conditions may have an impact. 

5.3.5 There is a strong suspicion that very modest degrees of lossy compression might not affect human 
observers. However there is increasing evidence that lossy compression is more likely to affect CAD (lesion 
detection and/or characterization). 

Given this uncertainty, it is required that: 

a) if a clinical trial involves a specific type of image and interpretation or measurement task that have 
specifically been demonstrated in a sufficiently statistically powerful not to be significantly and 
meaningfully influenced by a specific compression scheme and parameter choice, then such a scheme 
may be used, with prior documentation in the approved protocol and/or IRC 

b) if the standard of care for a particular modality is to generate lossy compressed images directly at the 
acquisition device (e.g., for the video record of an echocardiogram), then they may be used, but without 
further compression 

c) otherwise, if lossy compression performed at the acquisition device can be configured off, then it shall be 
and uncompressed or losslessly compressed images shall be used 

d) no lossy compression shall be permitted subsequently, whether it be during archival at the site, retrieval 
or transfer to the CRO or sponsor, or in any manner prior to independent review. 
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Note that the DICOM header should record whether or not the image is lossy compressed, or has ever been lossy compressed 
(and there is a corresponding medical device approval requirement related to this), so the CRO quality control shall check for 
and detect evidence of lossy compression. Failure to comply with the avoidance of lossy compression is a protocol violation and 
such images shall result in a discrepancy report, and query of and retraining of the site. 

The discrepancy report of protocol violations due to the unsanctioned use of lossy compression on a subset of subjects allows 
the reviewer of the results of a clinical trial to ascertain whether or not there was any impact on the outcome. 

5.4. Digitization 

Pure digital acquisition and transfer is preferred under all circumstances when possible to minimize loss of data from the 
original acquisition: 

5.4.1 Quantitative analysis of signal intensity (PET SUV, MR intensity) require digital data. 

5.4.2 Printed film from digital modalities should be used reluctantly if at all, and will typically be digitized prior to use. 

5.4.3 Some modalities, such as projection radiography, remain analog in most parts of the world, and review on film, or 
film digitizations are therefore required. Standards exist already for this digitization in clinical applications. The 
ACR Guidline on Digital Image Management specifies that for secondary image capture: 

a) Small-matrix images: Each individual image should be digitized to a matrix size as large as or larger than 
that of the original image on the imaging modality. The images should be digitized to a bit depth of 8 bits 
per pixel or greater. Film digitization or video frame grab systems conforming to the above specifications 
can be acceptable. 

b) Large-matrix images: These images should be digitized to a matrix size corresponding to 2.5 Ip/mm or 
greater in the original detector plane. These images should be digitized to a bit depth of 10 bits per pixel 
or greater. 

5.4.4. Use of medical grade equipment with appropriate QC procedures is recommended. 

5.4.5 Some types of film have additional specific equipment requirements (e.g., film-screen mammography film has a 
higher optical density than some digitizers can penetrate and higher spatial resolution requirements (e.g., <= 50 
microns). 

5.4.6 The IRC shall document the digitization parameters to be used for a specific study. 
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5.5. Retention 

The retention of medical image data after a trial is complete and/or submitted for regulatory approval is an area of uncertainty 
with respect to potentially inconsistent country and international regulations [Code of Federal Regulations (CFR) vs. 
International Conference on Harmonization (ICH) - Guideline for Good Clinical Practice (GCP)]. 

5.5.1 Medical Image Data 

The medical image data is considered an "essential document" as it can substantiate the existence, history, 
integrity and efficacy of the clinical trial data collected. 

CFR and GCP requirements are similar as to their record retention requirements. 

5.5.2 21 CFR Part 312.57 

A sponsor shall retain the records and reports required by this part for 2 years after a marketing application is 
approved for the drug; or, if an application is not approved for the drug, until 2 years after shipment and delivery of 
the drug for investigational use is discontinued and FDA has been so notified. 

5.5.3 ICH - GCP - Section 4.9 

Essential documents should be retained until at least 2 years after the last approval of a marketing application in 
an ICH region and until there are no pending or contemplated marketing applications in an ICH region or at least 2 
years have elapsed since the formal discontinuation of clinical development of the investigational product. These 
documents should be retained for a longer period however if required by the applicable regulatory requirements or 
by an agreement with the sponsor. It is the responsibility of the sponsor to inform the investigator/institution as to 
when these documents no longer need to be retained. 

5.5.4 Standard Operating Procedures (SOPs) 

Sponsors may also have specific Standard Operating Procedures (SOPs) requiring different (usually longer) 
record retention requirements. 

The retention requirements of the medical image data needs to be defined for the three distinct clinical trial 
participants: 

a) Investigational Site 

b) Imaging Core Lab (ICL) 

c) Sponsor 

5.5.5 In addition to the record retention requirements there are other issues that need to be further defined, 
a) Need to further define the specific image date to be retained by the Sites. 

• Original digital data vs. film data; 

• Does the site need a separate clinical trial archive vs. archiving with other daily clinical image data; 

• Identifiable versus de-identified and pseuonymized image data. 
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b) Need to further define the specific image date to be retained by the ICL. 

• Identifiable versus de-identified and pseuonymized 

• Original digital data if supplied digitally 

• Original film data often times needs to be returned to the sites. Only digitized copy is available. 

• Original image data with full audit trail of all quantitative analysis (regions of interest and/or 
associated measurements) should be archived. 

• Original image data with all relevant qualitative assessments should be archived. 

• Image data should be retained in an acceptable standardized image file format. 

c) If the Site and ICL have the medical images retained then the Sponsor does not need to retain a copy for 
regulatory (record retention) purposes. 

d) Potential technical issues with PACS systems and archiving the data. 

5.5.6 The form of archive for retention needs to be addressed, whether it be an on-line device or off-line media, and 
the requirements for long-term integrity of such a device. 

5.5.7 Images shall be retained in a format and on media that can be read at a later point: 

a) DICOM is state of the art for common modalities (MR, CT, PET) 

b) If other modalities (DEXA, Visual Light images), can store in another format (if DICOM conversion gives 
too much overhead) but needs to be well-established standard format wherever possible 

c) Exceptions may be necessary for old software and extremely new technology 

d) With respect to lossy compression, if used, the images should be archived the form in which they were 
interpreted, not compressed subsequently. 

e) Images interpreted digitally should not be stored as printed film. 
5.6 Re-USE-Goals 



5.6.1 Review applicable regulations on a global level (if possible) to identify requirements for data reuse 

5.6.2 Solicit feedback from sampling of IRBs and ethics committees to understand their interpretation of 
regulations and expectations for approval and consent 

5.6.3 Standardize the informed consent language in this regard without delaying approval by difficult IRBs or 
discouraging subject participation in clinical trial research 
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5.6.4 Applicable Global Regulations 



USA - HIPAA Privacy Rule 

The topic of data reuse is closely tied to what data is being shared and used, in particular if Protected Health 
Information (PHI) as defined by the HIPAA Privacy Rule is planned to be shared. 

De-identified data does not contain any PHI. 

PHI can only be shared after obtaining written Authorization from the individual (in this case, the research subject). De- 
identified data can be shared without obtaining Authorization. De-identified data is defined as: 

a) A data set that does not include any of the 18 elements of PHI (i.e., 'direct identifiers') 

b) Have a qualified statistician determine, using generally accepted statistical and scientific principles and 
methods, that the risk is very small that the information could be used, alone or in combination with other 
reasonably available information, by the anticipated recipient to identify the subject of the information. 



The HIPAA Privacy Rule also defines a 'limited data set' that excludes most of the PHI but allows some to remain. The 
following table defines PHI and what PHI is permitted in a limited data set. These definitions apply to information about 
the individual and to information about the individual's relatives, employers, or household members. 





Description 


Allowed in Limited 
Data Set 


1 


Names 




2 


All geographic subdivisions smaller than a state, except for the initial three digits of the zip code if the 
geographic unit formed by combining all zip codes with the same three initial digits contains more than 
20,000 people 


Data on town or city, 
state, and ZIP Code are 
OK 


3 


All elements of dates except year and all ages over 89 


Full Dates OK 


4 


Telephone numbers 




5 


Fax numbers 




6 


Email addresses 




7 


Social security numbers 




8 


Medical record numbers 




9 


Health plan beneficiary numbers 




10 


Account numbers 




11 


Certificate or license numbers 




12 


Vehicle identifiers and license plate numbers 




13 


Device identifiers and serial numbers 




14 


URLs 




15 


IP addresses 




16 


Biometric identifiers including fingerprints and voiceprints 




17 


Full-face photographs and any comparable images 




18 


Any other unique, identifying characteristic or code, except as permitted for re-identification in the Privacy 
Rule. 


OK 



Of note, under the Privacy Rule, neither blood nor tissue, in and of itself, is considered individually identifiable health 
information; therefore, research involving only the collection of blood or tissue would not be subject to the Privacy 
Rule's requirements. 

Limited data sets can be shared by a Covered Entity with Authorization provided a data use agreement is in place with 
the receiving party. A Data Use Agreement is an agreement into which the Covered Entity enters with the intended 
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recipient of a limited data set that establishes the ways in which the information in the limited data set may be used 
and how it will be protected. 

IRB Approval - The Privacy Rule does not require IRB review or approval of Authorization language for research or 
disclosure of PHI. 

ICF and Authorization - The Informed Consent Form and Authorization serve different purposes. Under the Privacy 
Rule, a patient's Authorization is for the use and disclosure of PHI, which can include use or disclosure for research 
purposes. In contrast, an individual's informed consent, as required by the HHS or FDA Protection of Human Subjects 
Regulations, is a consent to participate in the research study as a whole, not simply a consent for the research use or 
disclosure of PHI. Nevertheless, it is permitted to combine Authorization for release of PHI with the ICF of the clinical 
trial. 

Authorization End Date -Authorization documents can indicate and end data for research with subject data or leave 
the end date open. 

EU - Privacy Directive 

TBD. 

Japan 

TBD. 

5.6.5 Proposed Standardized Informed Consent 

To initiate a discussion on standardizing the necessary language to allow for re-use, the following examples are 
presented for review, paraphrased from real-world examples of commercial and academic device and drug trials. 

Some questions related to the examples are: 

a) Is there a need to allow the subject to participate in the study but "opt out" of re-use - should these be 
separate documents? 

b) Is there a need to emphasize that while confidentiality will be protected a guarantee can not be made 
that personal confidential information will not be shared? 

c) Is there a need to explicitly specify the individuals and organizations that will be allowed access for re- 
use, or the general category of such individuals and organizations, or public accessibility for re-use ? 

d) Is there a need to provide for revocation of consent for re-use, and constraint the revocation to future re- 
use (as opposed to uses that have already occurred) ? 

e) Are there "ownership" issues ? i.e., in the US, "the site owns the record, the patient owns the information" 
- exactly who is consenting to what in terms of implications for re-use. 
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Example 1. 

The sponsor plans to combine the health information obtained from subjects' study records from this and 
other research studies in a database. All subject information that is collected and combined will be 
anonymous, which means that the information cannot be linked to a specific study subject. The sponsor 
will use the information to help improve the device and to conduct future medical device development. 

I consent to the sponsor using my personal information for future research related to this study, including 
anonymised database compilations. 

Example 2. 

The exams performed during this study may be retained for a least XX years, but without information that 
may identify you personally. Organizations that may inspect and/or copy your research records for 
quality assurance or data analysis include groups such as the XX, YY, and other organizations that have 
a role in this study. 

Information acquired from this study may be used in the future for secondary research to advance the 
understanding of disease. No individual name or results that could identify you personally will be used in 
any reports or publications. 

In respect for your privacy, all efforts will be made to keep your personal information confidential but we 
cannot guarantee absolute confidentially. Your personal information may be disclosed if required by law. 

Example 3. 

The site " http://privacvruleandresearch.nih.goV/authorization.asp#samplelang " provides sample text for 
the research use of health information, but does not specifically address re-use beyond the initially 
intended purpose, nor the re-use of de-identified data (or limited data sets). 

Example 4. 

If Central review for the study will be conducted please insert the following text in ICF: 

When you sign this consent form you will be agreeing for the original scan to be used to assess the effect 
of the medication on the growth of your disease by your doctor and you will also be agreeing for a copy 
of your scans to be sent to XXX for independent review of your data. 

Optional wording to be included in "How will my personal data be used" section: 

In order to process the radiology scans, the vendor may have access to some of your personal 
identifying information. The vendor will maintain confidentiality by removing all the personal identifying 
information on your radiology scans. 

For an exploratory end-point analysis (academical collaboration) the following wording was incorporated 
in the ICF and received IRB approval. 

MRI orCT scans will be performed in this study to assess your tumor(s) size and location. The results 
from these scans may also be used by your physician, by the sponsor or its research partners for 
development of new scanning methods for possible use in future patients. Your scan results will not be 
given to any other parties. 
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5.7 Initiation and Monitoring 

In order to ensure that reliable and consistent image data are acquired during the course of clinical trials, it is necessary that 
certain elements be put in place prior to the first patient scan at each trial site. In particular: 

5.7.1 At least one representative from Radiology should be involved in site initiation activities, and a primary Radiology 
point of contact should be established 

5.7.2 Clear communications should be established between the Radiology point of contact, the site principal 
investigator, the imaging CRO (if any), and the study sponsor. 

5.7.3 A thorough assessment of the imaging equipment, data handling capabilities, and site personnel should be carried 
out to ensure that the site is capable of supporting the defined imaging protocol. 

5.7.4 The Radiology point of contact should be provided with documentation detailing procedures for patient 
preparation, data acquisition, data handling, and transfer of image data to the imaging CRO. Training should be 
provided to ensure that all documentation and trial procedures have been understood, and that Radiology is 
willing and able to comply with the protocol and data handling procedures. 

5.7.5 Where verification of quantitation or spatial resolution/uniformity is an important factor in the trial, a specific 
qualification step using a phantom designed to test these aspects of image acquisition should be carried out. 

5.7.6 In complex protocols where the parameters differ significantly from clinical practice, site compliance to acquisition 
and data transfer guidelines should be verified through a test transfer prior to first patient scanning. 

5.7.7 In other studies, compliance should be assessed based on the first subject scanned. 

Once sites have begun collecting image data, it is important to monitor the quality of data being acquired, and to verify 
continued adherence to the defined imaging protocol. It is recommended that either the study sponsor or the imaging CRO: 

5.7.8 Review data for quality purposes as it is collected in order to catch and correct any protocol deviations with 
minimal data loss. 

5.7.9 Provide immediate feedback to the site Radiology point of contact regarding protocol deviations, errors in data 
transfer, etc. 

5.7.10 Provide additional training when warranted due to changes in site personnel and repeated protocol deviations 
inclusive. 

5.7.1 1 Maintain periodic communication with the site Radiology point of contact, particularly during periods of low patient 
accrual. 

5.7.12 Recalcitrant sites (or all sites for particularly demanding protocols) may need actual on-site monitoring by 
sponsor, CRO or other third party, specifically directed to failure to transfer images at all or in a timely manner, 
correction of repeated protocol violation, re-training, monitoring of compliance with source document retention 
policy and use of trained and qualified staff. 

5.7.13 The IRC should specify explicitly whether, when the baseline violates the acquisition parameters, subsequent 
time points return to the protocol-specified parameters rather than repeating the same "incorrect" exam. 

5.8 Validation 

- Applicability of recent FDA guidance entitled "Computerized Systems Used in Clinical Investigations" 
( http://www.fda.gov/cder/quidance/7359fnl.htm ) to CRO software and site software and medical devices. E.g., for de- 
identification in sites, communicating with PACS to central lab, etc. Is this within the scope of the FDA to regulate or be 
concerned about. 
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